CVSS: 5.4EPSS: 0%CPEs: 8EXPL: 0CVE-2007-0275
https://notcve.org/view.php?id=CVE-2007-0275
17 Jan 2007 — Cross-site scripting (XSS) vulnerability in Oracle Reports Web Cartridge (RWCGI60) in the Workflow Cartridge component, as used in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.3; Application Server 9.0.4.3, 10.1.2.0.2, and 10.1.2.2; Collaboration Suite 10.1.2; and Oracle E-Business Suite and Applications 11.5.10CU2; allows remote authenticated users to inject arbitrary HTML or web script via the genuser parameter to rwcgi60, aka OWF01. Vulnerabilidad de tipo cross-site-scripting (XSS) en Oracle Reports Web... • http://osvdb.org/32906 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 8%CPEs: 3EXPL: 0CVE-2006-5334
https://notcve.org/view.php?id=CVE-2006-5334
18 Oct 2006 — Unspecified vulnerability in Oracle Spatial component in Oracle Database 9.0.1.5, 9.2.0.7, and 10.1.0.5 has unknown impact and remote authenticated attack vectors related to mdsys.md2, aka Vuln# DB03. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB03 is related to one or more of (1) a buffer overflow in the (a) RELATE function or (2) SQL injection in the (b) TESSELATE_FIXED and (c) TESSELATE function. Vulnerabilidad no especificada en el componente Oracle Spatial en... • http://secunia.com/advisories/22396 •
CVSS: 9.0EPSS: 4%CPEs: 3EXPL: 0CVE-2006-5336
https://notcve.org/view.php?id=CVE-2006-5336
18 Oct 2006 — Multiple unspecified vulnerabilities in the Change Data Capture (CDC) component in Oracle Database 9.2.0.7, 10.1.0.5, and have unknown impact and remote authenticated attack vectors related to (1) sys.dbms_cdc_ipublish (Vuln# DB05) and (2) sys.dbms_cdc_isubscribe (DB06). NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB05 is for SQL injection in CREATE_CHANGE_TABLE and CHANGE_TABLE_TRIGGER, and DB06 is for PL/SQL injection in the PREPARE_UNBOUNDED_VIEW procedure. Múlt... • http://secunia.com/advisories/22396 •
CVSS: 9.0EPSS: 5%CPEs: 4EXPL: 0CVE-2006-5337
https://notcve.org/view.php?id=CVE-2006-5337
18 Oct 2006 — Unspecified vulnerability in the Core RDBMS component in Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 has unknown impact and remote authenticated attack vectors, aka Vuln# DB09. Vulnerabilidad no especificada en el componente Core RDBMS en Oracle Database 9.0.1.5, 9.2.0.8, 10.1.0.5 y 10.2.0.2 tiene impacto y vectores de ataque autenticado remoto desconocidos, también conocida como Vuln# DB09. • http://secunia.com/advisories/22396 •
CVSS: 9.8EPSS: 10%CPEs: 5EXPL: 0CVE-2006-5340
https://notcve.org/view.php?id=CVE-2006-5340
18 Oct 2006 — Multiple unspecified vulnerabilities in Oracle Spatial component in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.8, 10.1.0.5, and 10.2.0.2 have unknown impact and remote authenticated attack vectors related to (1) mdsys.sdo_lrs, aka Vuln# DB13, and (2) Vuln# DB17. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB13 is related to bypassing input validation for SQL injection related to convert_to_lrs_layer and dbms_assert, and DB17 is related to SQL injection in the trigger ... • http://archive.cert.uni-stuttgart.de/archive/bugtraq/2006/07/msg00489.html •
CVSS: 9.0EPSS: 5%CPEs: 3EXPL: 0CVE-2006-5341
https://notcve.org/view.php?id=CVE-2006-5341
18 Oct 2006 — Multiple unspecified vulnerabilities in XMLDB component in Oracle Database 9.2.0.8, 10.1.0.5, and 10.2.0.2 have unknown impact and remote authenticated attack vectors, aka (1) Vuln# DB14 and (2) DB15 related to xdb.dbms_xdbz. NOTE: as of 20061023, Oracle has not disputed reports from reliable third parties that DB14 is for SQL injection in the PITRIG_DROP and PITRIG_DROPMETADATA functions in XDB_PITRIG_PKG, and DB15 is for SQL injection in DISABLE_HIERARCHY_INTERNAL in DBMS_XDBZ. Múltiples vulnerabilidades ... • http://secunia.com/advisories/22396 •
CVSS: 10.0EPSS: 4%CPEs: 4EXPL: 0CVE-2006-3702
https://notcve.org/view.php?id=CVE-2006-3702
19 Jul 2006 — Multiple unspecified vulnerabilities in Oracle Database 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 have unknown impact and attack vectors, aka Oracle Vuln# (1) DB06 in Export; (2) DB08, (3) DB09, (4) DB10, (5) DB11, (6) DB12, (7) DB13, (8) DB14, and (9) DBC01 for OCI; (10) DB16 for Query Rewrite/Summary Mgmt; (11) DB17, (12) DB18, (13) DB19, (14) DBC02, (15) DBC03, and (16) DBC04 for RPC; and (17) DB20 for Semantic Analysis. NOTE: as of 20060719, Oracle has not disputed third party claims that DB06 i... • http://secunia.com/advisories/21111 •
CVSS: 9.8EPSS: 5%CPEs: 4EXPL: 1CVE-2006-1866
https://notcve.org/view.php?id=CVE-2006-1866
20 Apr 2006 — Multiple unspecified vulnerabilities in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and other versions have unknown impact and attack vectors in the (1) Advanced Replication component, as identified by Vuln# DB01, and (2) Oracle Spatial component, as identified by Vuln# DB10. NOTE: details are unavailable from Oracle, but as of 20060421, they have not publicly disputed a claim by a reliable independent researcher that states that DB01 is an unknown issue in the DBMS_REPUTIL package, and DB10... • http://secunia.com/advisories/19712 •
CVSS: 9.8EPSS: 2%CPEs: 5EXPL: 1CVE-2006-1870
https://notcve.org/view.php?id=CVE-2006-1870
20 Apr 2006 — Unspecified vulnerability in Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, and 10.2.0.2 has unknown impact and attack vectors in the Export component, aka Vuln# DB05. NOTE: details are unavailable from Oracle, but as of 20060427, they have not publicly commented on whether DB05 is the same issue as CVE-2006-2081. Vulnerabilidad no especificada en Oracle Database Server 8.1.7.4, 9.0.1.5, 9.2.0.7, 10.1.0.5, y 10.2.0.2 con impacto y vectores de ataque desconocidos en el componente Export (Exporta... • http://secunia.com/advisories/19712 •
CVSS: 9.8EPSS: 2%CPEs: 2EXPL: 1CVE-2006-1871
https://notcve.org/view.php?id=CVE-2006-1871
20 Apr 2006 — SQL injection vulnerability in Oracle Database Server 9.2.0.7 and 10.1.0.5 allows remote attackers to execute arbitrary SQL commands via the DELETE_FROM_TABLE function in the DBMS_LOGMNR_SESSION (Log Miner) package, aka Vuln# DB06. Vulnerabilidad de inyección de Oracle Database Server 9.2.0.7 y 10.1.0.5 permite a atacantes remotos ejecutar órdenes SQL de su elección mediante la función DELETE_FROM_TALBE en el paquete DBMS_LOGMNGR_SESSION (Log Miner), tcc Vuln# DB06. • http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045280.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •